There were 2 vulnerabilities corrected in 5.10. They can be seen in the changelog. While there might be a vulnerability, being a problem depends on whether or not the site has subscribers. If I were you I would look at these, they may not be a problem on your site and I would not worry about it and ignore whatever is telling you that there is a problem.
As far as using the free version of ACF, this depends on whether any fields only available in Pro are used. This includes repeaters, acf blocks, flexible content, options pages, gallery field and clone field. If none of these features is used you can safely use the free version.
